Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2021-41034

The build of some language stacks of Eclipse Che version 6 includes pulling some binaries from an unsecured HTTP endpoint. As a consequence the builds of such stacks are vulnerable

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
eclipse

Description

The build of some language stacks of Eclipse Che version 6 includes pulling some binaries from an unsecured HTTP endpoint. As a consequence the builds of such stacks are vulnerable to MITM attacks that allow the replacement of the original binaries with arbitrary ones. The stacks involved are Java 8 (alpine and centos), Android and PHP. The vulnerability is not exploitable at runtime but only when building Che.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

The Eclipse Foundation Eclipse Che

  • 6.0 to < unspecifiedaffected
  • unspecified to < 7.0affected

References